2026-09-16_afaf196b8c33eb2384a56ab1715b6bf8_cobalt-strike_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-16_afaf196b8c33eb2384a56ab1715b6bf8_cobalt-strike_icedid_luca-stealer_njrat_stealc
Size 252KB
Sample260916-wpfaqsstcv
SHA256 086fa0e47abea7113a0a10e64a7d31ad304bc51d2259a054a3732b1f88aee022
MD5 afaf196b8c33eb2384a56ab1715b6bf8
SHA1 1765982c9698755980c9642751c94be67713b5d9
SHA512 6e20d59e999d6445eaa9adf0977fc18ea52bf55bd050190aa89d45561f4ebd1484d315fce01a6fa8573aa4c9c02f86d1426346ae09f213bd54641ed46433552d
SSDEEP 3072:5rU3QN1H92IBvUWs467Nqm8L8Cp08usIDofC0mWVX/7v0oB0sto:5kQH8IVh+qjLi0jDasu
TLSH
T134449C9AA75408EDCD3BA4B0D8114585E732B8FEC790F9CB53E522B65E936E05E3DB00
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-16_afaf196b8c33eb2384a56ab1715b6bf8_cobalt-strike_icedid_luca-stealer_njrat_stealc

File Explorer

2026-09-16_afaf196b8c33eb2384a56ab1715b6bf8_cobalt-strike_icedid_luca-stealer_njrat_stealc

.exe 252KB

2026-09-16_afaf196b8c33eb2384a56ab1715b6bf8_cobalt-strike_icedid_luca-stealer_njrat_stealc

IMPHASH a5c5bf52f6beec80e75cfda3c4a1994d
SHA256 086fa0e47abea7113a0a10e64a7d31ad304bc51d2259a054a3732b1f88aee022
MD5 afaf196b8c33eb2384a56ab1715b6bf8
SHA1 1765982c9698755980c9642751c94be67713b5d9
SHA512 6e20d59e999d6445eaa9adf0977fc18ea52bf55bd050190aa89d45561f4ebd1484d315fce01a6fa8573aa4c9c02f86d1426346ae09f213bd54641ed46433552d
SSDEEP 3072:5rU3QN1H92IBvUWs467Nqm8L8Cp08usIDofC0mWVX/7v0oB0sto:5kQH8IVh+qjLi0jDasu
TLSH
T134449C9AA75408EDCD3BA4B0D8114585E732B8FEC790F9CB53E522B65E936E05E3DB00
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

38276

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Build\Build_2021u_D20251014T165550\fa_rss\AppStoreSRV\x64\Release\AppStoreSRV.pdb

wtsapi32

WTSFreeMemory WTSEnumerateSessionsW WTSQueryUserToken

kernel32

FindResourceExW GetLastError CreateEventW CreateThread SetEvent GetFileAttributesW DeleteFileW FindFirstFileW FindClose FindNextFileW RemoveDirectoryW CopyFileW Sleep MultiByteToWideChar LocalFree FindResourceW GetCurrentProcess LocalAlloc ReleaseMutex CreateMutexW CreateFileMappingW MapViewOfFile WaitForMultipleObjects UnmapViewOfFile InitializeCriticalSectionEx DeleteCriticalSection GetConsoleMode GetConsoleOutputCP FlushFileBuffers LoadResource LockResource SizeofResource GetProcessHeap HeapAlloc HeapFree HeapReAlloc HeapSize HeapDestroy GetCommandLineW WaitForSingleObject CloseHandle GetExitCodeProcess CreateFileW WriteConsoleW TerminateProcess GetStringTypeW SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive GetCurrentThreadId WaitForSingleObjectEx GetExitCodeThread QueryPerformanceCounter QueryPerformanceFrequency WakeAllConditionVariable SleepConditionVariableSRW GetSystemTimeAsFileTime GetModuleHandleW GetProcAddress IsDebuggerPresent OutputDebugStringW RaiseException EnterCriticalSection LeaveCriticalSection RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent GetStartupInfoW GetCurrentProcessId InitializeSListHead RtlUnwindEx RtlPcToFileHeader SetLastError EncodePointer InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW ExitThread FreeLibraryAndExitThread GetModuleHandleExW ExitProcess GetModuleFileNameW GetStdHandle WriteFile GetCommandLineA FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect CompareStringW LCMapStringW GetFileType SetFilePointerEx FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetCPInfo WideCharToMultiByte

user32

wsprintfW

advapi32

SetSecurityDescriptorDacl InitializeSecurityDescriptor ConvertSidToStringSidW CreateProcessAsUserW GetLengthSid SetTokenInformation ConvertStringSidToSidW DuplicateTokenEx GetTokenInformation SetServiceStatus RegisterServiceCtrlHandlerExW StartServiceCtrlDispatcherW RegCloseKey RegQueryValueExW RegOpenKeyExW

shell32

CommandLineToArgvW

userenv

DestroyEnvironmentBlock CreateEnvironmentBlock

Name

.text

Size

124KB

Virtual Size

123KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

69KB

Virtual Size

68KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

33KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-16_afaf196b8c33eb2384a56ab1715b6bf8_cobalt-strike_icedid_luca-stealer_njrat_stealc

wtsapi32

kernel32

user32

advapi32

shell32

userenv

generic